CVE-2026-108100

Medium

Description

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.

SeverityMedium

CVSS6.5

Exploit probability—

ProductDanielbrendel Hortusfox-web

PublishedOct 9, 2026

First seenOct 9, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

danielbrendel hortusfox-web6.2 or later

Patches

github.com/danielbrendel/hortusfox-web/commit/c0c0f4057dd8376b63c34028de36c8c6b6288fee

Vendor advisories

github.com/danielbrendel/hortusfox-web/security/advisories/GHSA-4w8p-x2jj-42w7

Affected products

Product	Affected versions	Fixed in
danielbrendel hortusfox-web	v < 6.2	6.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.